Comments and answers for "Estimating index storage requirements?"
https://answers.splunk.com/answers/57452/estimating-index-storage-requirements.html
The latest comments and answers for the question "Estimating index storage requirements?"Answer by theunf
https://answers.splunk.com/answering/147372/view.html
I think you all missed the point of what replication_factor was used here and, maybe, if multisite cluster replication were used.
If the second option where not used and replication factor was 4, each log will reside on each node, so each node will need 4.5Tb of disk.
Same scenario with a replication factor of 2: If only 1 onde recieve logs, 2 nodes will use 4.5Tb and the other 2 nodes will recieve nothing. The replication pair selection is automatic and you may see it by searching on _audit or at settings->indexes at each node.Fri, 25 Jul 2014 02:43:26 GMTtheunfComment by lzhang_soliton on lzhang_soliton's answer
https://answers.splunk.com/comments/79473/view.html
_d_,
I am looking for the math to know the change of the size between before and after indexing. Could you point me how you get the math?
I calculate the size according to the document as R.Turk wrote.
raw data size: 9TB
"rawdata file size": 9TB x 10%
Minimum index size: (9TB x 10%) + ((9TB x 10%) x 10%)
Maximum index size: (9TB x 10%) + ((9TB x 10%) x 110%)
Thank you in advance.Fri, 15 Mar 2013 06:04:57 GMTlzhang_solitonComment by rturk on rturk's answer
https://answers.splunk.com/comments/57460/view.html
Thanks _d_, I was probably going to err on the side of caution anyway, but this is the answer I was looking for cheers :-)Mon, 03 Sep 2012 00:30:47 GMTrturkAnswer by _d_
https://answers.splunk.com/answering/57454/view.html
Yes, you have :) and the usage of the word "index" is the reason you're being mislead in this case.
When raw data is indexed, for each bucket, at a minimum, we store:
- an index structure that is associated with it (think of the index at the end of each book)
- a compressed file which contains the actual raw data (this is where your events are stored).
So the math goes like this:
index size = (index structure) + (compressed raw data) = 1/2 (size of uncompressed raw data)
Given your specs, this is what you should use to calculate:
`100GB x 90 days X 1/2 = 4.5TB total storage required between 4 indexers = 1.125TB/Indexer`
Hope this helps,
d.Sun, 02 Sep 2012 15:21:35 GMT_d_